Security for web services in 9.0.3?

Question

Hello all,
With regular Java Class Web Services, how do you declare logical security roles? Also, how do you declare method-level permissions based on those roles? Lastly, how about the security role mappings?
I am looking at http://otn.oracle.com/docs/products/ias/doc_library/903doc_otn/generic.903/a97681/security.htm
However, it does not mention anything about web services. Any help would be appreciated!
Thanks,
James

Answer 1

I am not sure it is possible to do what you want to do ... here are the two approaches you have:
1. When you publish a class the Web services publisher (either JDev or the Web Services Assembler tool), lets you wrap the class with an interface which becomes the available methods to the outside world. This is your first level of restriction regardless of authentication or authorization.
2. Then I can use constructs in the web.xml to map users of a specific URL pattern. Here, for example, is a sample for a class mypackage1.Class1 and its web.xml with BASIC authentication:
<web-app>
<description></description>
<servlet>
<servlet-name>mypackage1.Class1</servlet-name>
<servlet-class>oracle.j2ee.ws.StatelessJavaRpcWebService</servlet-class>
<init-param>
<param-name>class-name</param-name>
<param-value>mypackage1.Class1</param-value>
</init-param>
<init-param>
<param-name>interface-name</param-name>
<param-value>mypackage1.IClass1</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>mypackage1.Class1</servlet-name>
<url-pattern>/mypackage1.Class1</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>ws</web-resource-name>
<url-pattern>/mypackage1.Class1</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>BasicRole</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Enter a valid user</realm-name>
</login-config>
<security-role>
<role-name>BasicRole</role-name>
</security-role>
</web-app>
The crux of this method is the URL pattern ... once I match the URL pattern I will be subject to the security.
I also have to map from the orion-web.xml to the underlying authentication mechanism - here for example in the following I just use the default principals.xml, rather than working into JAAS and Oracle Internet Directory, where the users of BasicGroup might actually be defined:
<orion-web-app>
<security-role-mapping name="BasicRole">
<group name="BasicGroup"/>
</security-role-mapping>
</orion-web-app>
As the method is actually defined, assuming RPC, in the SOAP message that is posted, the URL pattern will not capture method level invocations.
Not sure this is what you are after but perhaps when you respond I will better understand where you want to go - the bottom line is that the Web services security is simply leveraging the Servlet model; it doesn't have method level security as say, for example, the underlying EJB model does.
Hope this helps.
Mike.